Goodwill Industries of Central Indiana has launched an internal investigation after 13 Investigates discovered the charity has been selling tax returns, medical records, social security numbers and other sensitive information mistakenly donated by its customers.

The personal information WTHR found for sale at Goodwill Outlet Stores has angered donors, shocked law enforcement and raised policy questions about the charity, which receives 1.9 million donations annually.

The problem was first identified by a longtime Goodwill donor and shopper.

Read more on WTHR, a news station that has a well-earned reputation for investigating privacy breaches in Indiana. While some of the personal information found for sale was likely unintentionally donated by the individuals themselves, some of the data may indicate that businesses or other entities are donating what should not be donated:

Among the records for sale at Goodwill, Eyewitness News found social security numbers, birthdates, addresses and other personal information for former and current employees from the Lawrence Police Department and the Marion County Sheriff’s Department.

“There’s hundreds of officers on here!” said Eads, paging through the internal rosters and memos.

So is this Goodwill’s fault? Not originally, but do they have any obligation to screen donations to yank what should not be sold? Does Indiana have a law barring the sale of personally identifiable information in this type of situation?